Skip to content
Commit a89db445 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin
Browse files

vhost: block speculation of translated descriptors



iovec addresses coming from vhost are assumed to be
pre-validated, but in fact can be speculated to a value
out of range.

Userspace address are later validated with array_index_nospec so we can
be sure kernel info does not leak through these addresses, but vhost
must also not leak userspace info outside the allowed memory table to
guests.

Following the defence in depth principle, make sure
the address is not validated out of node range.

Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Cc: stable@vger.kernel.org
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Tested-by: default avatarJason Wang <jasowang@redhat.com>
parent cf8f1696
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment